SpringBoot前后端分离项目使用SpringSecurity+JWT做权限认证，修改自定义认证过滤器的访问路径

http.formLogin()
            .loginProcessingUrl("/user/login")
            .usernameParameter("account")
            .passwordParameter("password")
            .permitAll();

通过几行简简单单的配置我们就可以将用户认证处理器url修改成/user/login了。

但是在前后端分离的项目中，如果我们要实现登录认证，就要使用Token来保存用户信息，并且要自定义一个用于登录认证的过滤器，继承UsernamePasswordAuthenticationFilter这个类，重写SpringSecurity的认证逻辑。我用到的是JWT来生成Token，这里贴出我的认证代码：

@Slf4j
public class JwtLoginFilter extends UsernamePasswordAuthenticationFilter {

    private final RsaKeys rsaKeys;
    private final AuthenticationManager authenticationManager;

    public JwtLoginFilter(AuthenticationManager manager, RsaKeys rsaKeys) {
        this.authenticationManager = manager;
        this.rsaKeys = rsaKeys;
    }

    
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        log.info("调用了自定义的登录认证过滤器");
        // 获取登录参数
        String account = request.getParameter("account");
        String password = request.getParameter("password");
        if(!StringUtils.hasText(account) || !StringUtils.hasText(password)) {
            // 参数不合法
            ResponseUtils.write(response, ResponseVO.fail(SysCode.UN_VALID_REQUEST_PARAMETER));
            return null;
        }
        // 构造SpringSecurity登录token
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(account, password);
        return this.authenticationManager.authenticate(token);
    }

    
    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        // 获取认证用户对象，去除敏感信息
        User user = (User) authResult.getPrincipal();
        user.setPassword(null);
        // 生成Token
        String authorization = JwtUtils.generateToken(user, rsaKeys.getPrivateKey());
        // 存入响应头并返回
        response.setHeader("Authorization", "Bearer " + authorization);
        ResponseUtils.write(response, ResponseVO.ok(SysCode.LOGIN_SUCCESS));
    }

    
    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
        ResponseUtils.write(response, ResponseVO.fail(SysCode.BAD_AUTHENTICATE));
    }
}

 这样子配置之后，再在SpringSecurity配置类中使用http.addFilter加入我们自定义的这个过滤器就可以通过请求http://localhost:8080/login接口并且携带登录参数来进行登录认证了，认证成功之后会将Token设置在响应头中，然后前端拿到Token进行其他的请求。

 那么，如果我不想要这个默认接口呢？我的接口规范就是要/api @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { log.info("调用了自定义的登录认证过滤器"); // 获取登录参数 String account = request.getParameter("account"); String password = request.getParameter("password"); if(!StringUtils.hasText(account) || !StringUtils.hasText(password)) { // 参数不合法 ResponseUtils.write(response, ResponseVO.fail(SysCode.UN_VALID_REQUEST_PARAMETER)); return null; } // 构造SpringSecurity登录token UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(account, password); return this.authenticationManager.authenticate(token); } @Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { // 获取认证用户对象，去除敏感信息 User user = (User) authResult.getPrincipal(); user.setPassword(null); // 生成Token String authorization = JwtUtils.generateToken(user, rsaKeys.getPrivateKey()); // 存入响应头并返回 response.setHeader("Authorization", "Bearer " + authorization); ResponseUtils.write(response, ResponseVO.ok(SysCode.LOGIN_SUCCESS)); } @Override protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException { ResponseUtils.write(response, ResponseVO.fail(SysCode.BAD_AUTHENTICATE)); } }

在SpringSecurity配置类中，无需添加http.formLogin配置，只要配置自定义过滤器即可

@Override
protected void configure(HttpSecurity http) throws Exception {
    // 放行所有接口，由注解进行限制
    http.authorizeRequests()
            .antMatchers("/**").permitAll();
    // 添加自定义的过滤器
    http.addFilter(new JwtLoginFilter(authenticationManager(), rsaKeys))
            .addFilter(new JwtVerifyTokenFilter(authenticationManager(), rsaKeys));
    // csrf拦截
    http.csrf().disable();
}

 以上就是本篇文章的所有内容了，希望对你有帮助！